[PATCH 05/33] netns ct: per-netns expectations

Patrick McHardy kaber at trash.net
Tue Sep 9 00:10:34 PDT 2008

Alexey Dobriyan wrote:
> On Tue, Sep 09, 2008 at 07:49:34AM +0200, Patrick McHardy wrote:
>>> @@ -406,7 +404,7 @@ int nf_ct_expect_related(struct nf_conntrack_expect *expect)
>>>  		}
>>>  	}
>>>  -	if (nf_ct_expect_count >= nf_ct_expect_max) {
>>> +	if (net->ct.expect_count >= nf_ct_expect_max) {
>>>  		if (net_ratelimit())
>>>  			printk(KERN_WARNING
>>>  			       "nf_conntrack: expectation table full\n");
>> I assume these message are globally visible even with namespaces?
>> Can we make this (and the corresponding ct hash message) refer to
>> the namespace? Otherwise it might be a bit confusing.
> This is somewhat peculiar situation.
> netns doesn't have unique ID like, say, ifindex.
> The only number related to netns is "struct net *". They can be
> distinguised by pointer value, but userspace when does clone(CLONE_NEWNET)
> do not, obviously, control it and after creation doesn't have a way to find
> it out.
> And if we print with "%p, net" kernelspace pointer get exposed which is
> not nice.

No, that also wouldn't solve the confusion. I guess conntrack is not
the only subsystem which prints netns related messages, so how about
adding an unique identifier that can be associated by userspace?

More information about the Containers mailing list